Roles decide what your people can do in ReFresh. Every organisation starts with a set of roles ReFresh provides, and admins can build their own custom roles with exactly the permissions a job needs. This article covers the whole picture: provided roles versus custom roles, how permissions work, creating and assigning roles, and default roles. For the rules that stop a role change going wrong, see Role guardrails and edge cases.
Where to find it
Go to Settings, then Admin, then Roles. You need a role that includes role-management permissions to open it, which Organization Admin does by default. If you cannot see it, ask an Organization Admin.
The Roles page showing the Role, Type, and Where it can be used.
Provided roles versus custom roles
Every role is one of two kinds, shown in the Type column.
Provided roles are maintained by ReFresh and shipped to every organisation. They are read-only: you cannot change what they do, but you can use them as they are or copy them. The provided roles are:
Organization Admin: administrative access for the whole organisation.
Admin: full management access without billing. It can be assigned for the whole organisation or for a single group.
Incident Manager: triages, investigates and closes incidents, and raises the tasks that follow.
Survey Manager: builds surveys from templates, sends them, and reviews the results.
IT Admin: technical setup for integrations, people-data sync, sending domains, email branding, teams and single sign-on checks.
Custom roles are the ones your organisation creates. You have full control over the name, description, permissions and admin access, and you can edit or delete them.
The Where it can be used column shows a role's reach: "Whole organisation", or "Whole organisation and groups" for a role that can also be granted to someone for a specific group only.
"Templates from us" means provided roles: A provided role is a starting point maintained by ReFresh. You do not edit the provided role itself; you duplicate it to create a custom role that you own and can change (see below). This is the same idea as survey templates: platform templates that you copy, and custom ones that you manage.
How permissions work
A role is a set of permissions. In the editor, permissions are organised into categories (for example: Incidents and investigations, Risk and hazards, Controls, Surveys, Obligations and frameworks, People, Roles and access, Organisation settings, Reports, and Sign-in and SSO, among roughly two dozen in total). Selecting a category on the left shows its permissions on the right, grouped by the thing they act on, each offering up to four actions:
View: see the records.
Create: add new ones.
Edit: change existing ones.
Delete: remove them.
Each action has a plain-language description. Read it, because some permissions apply to the whole organisation's records, not only the holder's own. For example, a "View" permission may say "across your organisation, not just your own". Grant those deliberately. There is more on this in Role guardrails and edge cases.
The role editor's permissions picker: category listed on the left with counts of how many permissions are currently selected, with selected permissions on the right.
Creating a custom role
You can build a role from scratch or by copying an existing one.
From scratch:
Go to Settings, then Admin, then Roles, and select Create Role.
Give the role a Name (for example, "Incident Triage Manager") and an optional Description of what it is for.
Decide whether to allow admin panel access (see the next section).
Work through the permission categories and tick the actions this role should have.
Select Create Role.
By duplicating:
Recommended when you want a provided role as a starting point.
Open any role and select Duplicate. On a provided role this reads Duplicate to Customise.
ReFresh creates an editable custom copy that carries the same permissions and reach. Rename it and adjust the permissions.
The role creation page, allowing you to enter the Name, Description, access to the Admin Panel, and select the permissions to add to the role.
Admin panel access, an important setting
At the top of the role editor is a setting called Allow admin panel access, described as "Holders can open the admin app. Without it they stay in My ReFresh."
This sits apart from the permission list on purpose, because it answers a different question. The permissions decide what a role can do; this setting decides whether the holder can reach the admin app at all.
On: the holder can open the admin app and use the admin permissions you granted.
Off: the holder stays in My ReFresh, the worker portal. This is correct for portal-only roles. For example, a site representative who only reports incidents and completes surveys should never enter the admin app.
If you grant a role admin permissions but leave this setting off, those permissions do nothing, because the holder has no way to reach the screens they unlock. If a role seems to do nothing after you assign it, check this setting first.
Assigning a role to people
There are three ways someone gets a role:
Directly: open the role, go to the People tab, and add a person. You can grant the role for the whole organisation or, for group-scoped roles, for a specific group. The People tab also shows everyone who currently holds the role.
On invite: when you invite someone (Settings, then Admin, then Invites), they join with the organisation's default role (see below), and you can pick a different role for that invite.
Through single sign-on (SSO): if you use SSO, each connection has a default role for people who sign in through it, and you can map identity-provider groups to roles so people land in the right role automatically. See your SSO setup guide.
The role's "People" tab, showing current holders with the role and the ability to add additional people. You can also click on the user's name to open their details.
Default roles
A default role is what someone receives when nothing more specific applies. ReFresh has three, from broadest to narrowest:
Organisation default: set under Settings, then Admin, then Company. New members and invites receive this role unless you choose another.
Group default: each group can set its own default role (under Settings, then Admin, then Teams, then the group), used for people who join that group.
SSO connection default: each SSO connection has a default role for sign-ins that do not match a more specific mapping, and it falls back to the organisation default.
A default role cannot be deleted: A role that is currently set as a default cannot be deleted until you choose a different default first. See Role guardrails and edge cases.
Editing and deleting a custom role
Edit: open a custom role to change its name, description, permissions or admin access. Provided roles cannot be edited, so duplicate them instead.
Delete: open the custom role and use Delete Role. Deleting a role removes its permissions from everyone who holds it, so ReFresh blocks a delete that would break access or lock you out. See the guardrails article for exactly when a delete is refused and why.